The OSV evaluator should allow ignoring CVEs

[jhrozek]

Some packages have CVEs that will never be fixed. This might mean that updates bumping that package as a dep would perpetually be marked as changes requested by minder.

We should extend the OSV evaluator to allow for ignoring CVEs.

[mesembria]

Will revisit once we refactor our OSV rule.

[evankanderson]

This still needs to be figured out, though it should happen in a Minder ruletype, not in the core engine.